Which of the following quantitative measures is KEY for an auditor to review when assessing the implementation of continuous auditing of performance on a cloud system?

Recovery Point Objectives (RPO)

In cloud computing, with whom does the responsibility and accountability for compliance lie?

The cloud service customer is responsible for compliance, and the cloud service provider is accountable.

The cloud service provider is responsible and accountable for compliance.

The cloud service provider is responsible for compliance, and the cloud service customer is accountable.

The cloud service customer is responsible and accountable for compliance.

The cloud service customer is responsible for compliance, and the cloud service provider is accountable.

A certification target helps in the formation of a continuous certification framework by incorporating:

service level objective and service qualitative objective.

frequency of evaluating security attributes.

scope description and security attributes to be tested.

Which of the following are the three MAIN phases of the cloud controls matrix (CCM) mapping methodology?

Preparation --> Execution --> Peer Review and Publication

Initiation --> Execution --> Monitoring and Controlling

Preparation --> Execution --> Peer Review and Publication

Which of the following activities are part of the implementation phase of a cloud assurance program during a cloud migration?

Identification of processes, functions, and systems

Development of the monitoring goals and requirements

Identification of processes, functions, and systems

Identification of the relevant laws, regulations, and standards

Identification of roles and responsibilities

The three layers of Open Certification Framework (OCF) PRIMARILY help cloud service providers and cloud clients improve the level of:

legal and regulatory compliance.

Which industry organization offers both security controls and cloud-relevant benchmarking?

International Organization for Standardization (ISO)

Center for Internet Security (CIS)

In cloud computing, which KEY subject area relies on measurement results and metrics?

Service level agreements (SLAs)

Software as a Service (SaaS) application services

Infrastructure as a Service (IaaS) storage and network

Platform as a Service (PaaS) development environment

Service level agreements (SLAs)

A certification target helps in the formation of a continuous certification framework by incorporating:

the scope description and security attributes to be tested.

the service level objective (SLO) and service qualitative objective (SQO).

the scope description and security attributes to be tested.

the frequency of evaluating security attributes.

Why should the results of third-party audits and certification be relied on when analyzing and assessing the cybersecurity risks in the cloud?

To contrast the risk generated by the loss of control

To establish an audit mindset within the organization

To contrast the risk generated by the loss of control

To reinforce the role of the internal audit function

To establish an accountability culture within the organization

If a customer management interface is compromised over the public Internet, it can lead to:

computing and data compromise for customers.

ease of acquisition of cloud services.

access to the RAM of neighboring cloud computers.

Which of the following is an example of a corrective control?

Unsuccessful access attempts being automatically logged for investigation

A central antivirus system installing the latest signature files before allowing a connection to the network

All new employees having standard access rights until their manager approves privileged rights

Unsuccessful access attempts being automatically logged for investigation

Privileged access to critical information systems requiring a second factor of authentication using a soft token

What is the MOST effective way to ensure a vendor is compliant with the agreed-upon cloud service?

Examine the cloud provider's certifications and ensure the scope is appropriate.

Document the requirements and responsibilities within the customer contract

Interview the cloud security team and ensure compliance.

Pen test the cloud service provider to ensure compliance.

Which of the following is MOST useful for an auditor to review when seeking visibility into the cloud supply chain for a newly acquired Software as a Service (SaaS) solution?

Payments made by the service owner

Cloud compliance obligations register

Which of the following is the PRIMARY area for an auditor to examine in order to understand the criticality of the cloud services in an organization, along with their dependencies and risks?

Contractual documents of the cloud service provider

Which of the following is the BEST method to demonstrate assurance in the cloud services to multiple cloud customers?

External attestation and certification audit reports

Provider's financial stability report and market value

Reputation of the service provider in the industry

Provider self-assessment and technical documents

External attestation and certification audit reports

What is the FIRST thing to define when an organization is moving to the cloud?

Internal service level agreements (SLAs)

To BEST prevent a data breach from happening, cryptographic keys should be:

distributed in public-facing repositories.

What type of termination occurs at the initiative of one party and without the fault of the other party?

Termination at the end of the term

Which of the following types of risk is associated specifically with the use of multi-cloud environments in an organization?

Risk of reduced visibility and control

Risk of supply chain visibility and validation

Risk of reduced visibility and control

Risk of service reliability and uptime

Risk of unauthorized access to customer and business data

is it important for the individuals in charge of cloud compliance to understand the organization's past?

To address any open findings from previous external audits

To determine the current state of the organization's compliance

To determine the risk profile of the organization

To address any open findings from previous external audits

To verify whether the measures implemented from the lessons learned are effective

organization should document the compliance responsibilities and ownership of accountability in a RACI chart or its informational equivalents in order to:

provide a holistic and seamless view of the enterprise's responsibility for compliance with prevailing laws and regulations.

provide a holistic and seamless view of the cloud service provider's responsibility for compliance with prevailing laws and regulations.

provide a holistic and seamless view of the enterprise's responsibility for compliance with prevailing laws and regulations.

conform to the organization's governance model.

define the cloud compliance requirements and how they interplay with the organization's business strategy, goals, and other compliance requirements.

Which of the following helps an organization to identify control gaps and shortcomings in the context of cloud computing?

User security awareness training

What is below the waterline in the context of cloud operationalization?

The controls operated by the cloud service provider

The controls operated by the customer

The controls operated by the cloud access security broker (CASB)

The controls operated by the cloud service provider

Which of the following is MOST important to ensure effective operationalization of cloud security controls?

Identifying business requirements

Comparing different control frameworks

Which of the following activities is performed outside information security monitoring?

Management review of the information security framework

Monitoring the effectiveness of implemented controls

Collection and review of security events before escalation

Periodic review of risks, vulnerabilities, likelihoods, and threats

Which of the following is a KEY benefit of using the Cloud Controls Matrix (CCM)?

CCM maps to existing security standards, best practices, and regulations.

CCM utilizes an ITIL framework to define the capabilities needed to manage the IT services and security services.

CCM maps to existing security standards, best practices, and regulations.

CCM uses a specific control for Infrastructure as a Service (laaS).

CCM V4 is an improved version from CCM V3.0.1.

Which of the following cloud environments should be a concern to an organization s cloud auditor?

The technical team is trained on only one vendor Infrastructure as a Service (laaS) platform, but the organization has subscribed to another vendor's laaS platform as an alternative.

The cloud service provider s data center is more than 100 miles away.

The technical team is trained on only one vendor Infrastructure as a Service (laaS) platform, but the organization has subscribed to another vendor's laaS platform as an alternative.